Control A.6.7Remote working
Security measures must be implemented when personnel are working remotely to protect information accessed, processed or stored outside the organisation’s premises.
The control the 2022 edition rewrote around the reality that remote work is not exceptional. It covers the physical environment — who else can see the screen, what is left on the desk, how a home office is secured — the connection, the device, and the handling of information in a setting the organisation does not control.
The device is where most organisations concentrate, and A.8.1’s endpoint controls do that work. The parts more often neglected are the physical and the human: shared living space, a home network with devices nobody is managing, and printed material outside the organisation’s disposal arrangements.
For organisations operating across borders, remote work also raises questions this control makes visible — where the data is being accessed from, what law applies there, and whether a supervisory obligation is affected by the answer.
How to put this in place
Once people work outside the office, your boundary moves with them, and the scope has to account for that. Rules written for a network the company no longer uses protect nothing.
- Decide where, on what devices and over which connections people may work remotely.
- Write short remote working rules covering device protection, public places and confidential calls.
- Enforce what you can technically, such as device encryption, managed devices and conditional access.
- Brief remote staff and have them acknowledge the rules.
- Check the technical settings against the rules at least yearly.
Evidence an auditor usually looks for: the remote working rules, acknowledgements, and device management or conditional access settings that match them.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists rules for remote working among the documents auditors commonly expect for this control.